Permissions, Rights & Privileges

Question

I only have the privileges of a normal user on a Windows environment (XP). I would like to ask the following questions.

(1) Are any/all attempts to access a log file(text) logged somewhere ?

(2) Are any attempts to delete a log file logged ?

(3) What are the available command lines ways to modify a log file ?

(4) By Default, what are the permissions I(normal user) have to a log file & a folder ?

(5) Without admin privileges, can I still be able to modify the log files or folders ?

Supposedly, if I were to be in another environment (Exchange Server 2003), & I only have the privileges of a normal user, will there be any difference in the answers to the above questions ?

Thank you very advance.

Answer 1

1. Are any/all attempts to access a log file(text) logged somewhere ?

   The Windows Event Logs are the place to see everything that is logged.

   Control Panel\Administrative Tools\Event Viewer
   

   is where you go to see them. Unfortunately, only parts of these are view-able without admin privileges.

   Of course, specific applications may choose not to use the event logs and may instead use their own files. In that case, whether you have access to them will depend on the application installation and the group policy settings.

   Access to application logs files will NOT be logged unless some other tool is installed specifically to do this.

2. Are any attempts to delete a log file logged ?

   Not unless the attempt fails because of security settings on the file, that will be logged as an audit failure. Or if an auditing utility is installed and set to monitor the file.

3. What are the available command lines ways to modify a log file ?

   Not clear what you mean by this. Text-based application log files are just text, assuming that they are not locked by a reservation (e.g. the application has locked the file open for reading or writing) they could be edited by any command that edits text - e.g. Notepad - and deleted by the usual delete command. Or you could:

   echo "rubbish" >c:\some\folder\filename.log
   

   Which would replace the contents with rubbish.

   This all depends on a non-admin user being able to access the file which again depends on both the specific application installation and the group policy settings (assuming you are part of a Windows Domain). It could also depend on specific settings to the file/folder applied by administrators.

   The Windows Event Logs are slightly different, a normal user can read some of the logs (e.g. the Application log) but cannot change them.

4. By Default, what are the permissions I(normal user) have to a log file & a folder ?

   As explained, if this is an application log file outside of the Windows Event Logs, it is not really possible to predict this. If you navigate to the file in Windows Explorer, right-click on the file and choose Properties. The security tab will show you what rights you have.

   For the Windows Event Logs, users have read-only access to the Application, System logs. They may have others if specific applications are installed. For example, Internet Explorer has its own log. They would not, however, have any access to the Security log. These settings can, however, be changed in group policies.

5. Without admin privileges, can I still be able to modify the log files or folders ?

   See the answers above.

Supposedly, if I were to be in another environment (Exchange Server 2003), & I only have the privileges of a normal user, will there be any difference in the answers to the above questions ?

Yes! Maybe/Probably! You are unlikely to have any access at all on an Exchange Server since you would not be expected to actually log-in to an Exchange Server directly, only using a client such as Outlook. You shouldn't have any direct access.